The source is
part of the story.

Follow the original account.

Incident disclosures, government advisories, court records, research reports and standards form the starting point. We link them so readers can examine their scope and distinguish a reported finding from an interpretation.

History keeps its dates.

Event dates and source publication dates are recorded separately. A retrospective account does not imply that Patch & Proof reported the event when it happened. Where a precise date is unknown, the uncertainty stays visible.

A claim has a field of view.

Vendor telemetry, survey results, loss estimates and attributed campaigns answer different questions. We identify the source, preserve relevant qualifications and publish corrections and source notes beside the archive.

Each dataset keeps its meaning.

EuRepoC’s historical affected-country records use country reference coordinates, not exact incident locations. Counts are aggregated by recorded start year; one incident can affect several countries. The map does not show live attack traffic.

Data: Zettl-Schabath et al., European Repository of Cyber Incidents, Global Dataset v1.3.2 (2000–2024), Zenodo, CC BY-NC 4.0. Patch & Proof aggregates the source records and adds reference coordinates for this free educational view.

CISA KEV identifies vulnerabilities confirmed as exploited. The advisory desk displays its source version and falls back to a dated bundled snapshot when the source is unavailable. That snapshot is an offline fallback, not a current feed.

The caption matters.

Research figures, corporate photographs, logos and illustrations retain their credits and source links. A contextual image is not presented as proof of a specific intrusion.

Choose how you take part.

Search, saved articles and the workbench operate in your browser. Newsletter signup and editorial correspondence are voluntary, separate actions. Read our privacy information or contact the desk.